Reject CORS websocket requests (#2011)
Reject CORS websocket requests (#2011)

* Reject CORS websocket requests

* compare host and origin request headers

* document stripping off protocol from origin header

* use a trimProtocol function

googledatalab/datalab,googledatalab/datalab,parthea/datalab,parthea/datalab,googledatalab/datalab,googledatalab/datalab,parthea/datalab,parthea/datalab,parthea/datalab,googledatalab/datalab,parthea/datalab,googledatalab/datalab